Mythic C2 Activity at Internet Scale

Mythic is an open-source command-and-control (C2) framework used by red teams and threat actors. Analysis found 131 unique Mythic C2 hosts exposed on the public Internet, with most using default TLS certificates. These deployments span major cloud providers and are concentrated in the US, Hong Kong, and China. Default artifacts such as TLS certificates with O=Mythic and port 7443 responses enable detection. Some clusters appear to be training environments, while isolated deployments with custom domains and advanced transport methods like Discord and steganography indicate operational use.

• Using KATA and KEDR to detect the AdaptixC2 agentMalware2026-04-17
• PIVOTPIPE: A New .NET-based Unofficial Beacon PayloadMalware2026-09-16
• Counterfeit installers to system compromise: Tracking a deceptive software download campaignCampaign2026-09-02
• Almost Half of Malware Samples Communicate Direct to IPMalware2026-08-04
• HollowGraph Malware Uses Microsoft 365 Calendar Invites for Covert Command-and-ControlAnalysis2026-07-22